aboutsummaryrefslogtreecommitdiffstats
path: root/Documentation
diff options
context:
space:
mode:
authorHenrique de Moraes Holschuh <hmh@hmh.eng.br>2010-02-25 20:22:22 -0500
committerHenrique de Moraes Holschuh <hmh@hmh.eng.br>2010-02-25 20:22:22 -0500
commitb525c06cdbd8a3963f0173ccd23f9147d4c384b5 (patch)
tree025b22fda39fc7a42061ab25a908abe3ae757d3b /Documentation
parent08fedfc903c78e380b0baa7b57c52d367794d0a5 (diff)
thinkpad-acpi: lock down video output state access
Given the right combination of ThinkPad and X.org, just reading the video output control state is enough to hard-crash X.org. Until the day I somehow find out a model or BIOS cut date to not provide this feature to ThinkPads that can do video switching through X RandR, change permissions so that only processes with CAP_SYS_ADMIN can access any sort of video output control state. This bug could be considered a local DoS I suppose, as it allows any non-privledged local user to cause some versions of X.org to hard-crash some ThinkPads. Reported-by: Jidanni <jidanni@jidanni.org> Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br> Cc: stable@kernel.org
Diffstat (limited to 'Documentation')
-rw-r--r--Documentation/laptops/thinkpad-acpi.txt4
1 files changed, 4 insertions, 0 deletions
diff --git a/Documentation/laptops/thinkpad-acpi.txt b/Documentation/laptops/thinkpad-acpi.txt
index 75afa1229fd7..39c0a09d0105 100644
--- a/Documentation/laptops/thinkpad-acpi.txt
+++ b/Documentation/laptops/thinkpad-acpi.txt
@@ -650,6 +650,10 @@ LCD, CRT or DVI (if available). The following commands are available:
650 echo expand_toggle > /proc/acpi/ibm/video 650 echo expand_toggle > /proc/acpi/ibm/video
651 echo video_switch > /proc/acpi/ibm/video 651 echo video_switch > /proc/acpi/ibm/video
652 652
653NOTE: Access to this feature is restricted to processes owning the
654CAP_SYS_ADMIN capability for safety reasons, as it can interact badly
655enough with some versions of X.org to crash it.
656
653Each video output device can be enabled or disabled individually. 657Each video output device can be enabled or disabled individually.
654Reading /proc/acpi/ibm/video shows the status of each device. 658Reading /proc/acpi/ibm/video shows the status of each device.
655 659